Message-ID: <23f8e02c904b1101fbcc1b91a9b299e5367f663b.camel@subnetz.org>
Subject: Re: applicable mapping for clientcert=verify-full
From: Tilman Koschnick <til+pg@subnetz.org>
To: pgsql-admin@lists.postgresql.org
Date: Fri, 12 Mar 2021 09:59:38 +0100
In-Reply-To: <f4677bbd8f990c53739043b8feabc69162540e64.camel@subnetz.org>
References: <f4677bbd8f990c53739043b8feabc69162540e64.camel@subnetz.org>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.30.5-1.1 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/23f8e02c904b1101fbcc1b91a9b299e5367f663b.camel%40subnetz.org>
Precedence: bulk

On Do, 2021-03-11 at 21:06 +0100, Tilman Koschnick wrote:
> How do I specify the applicable mapping in that case?

I've dug in a bit further. Since the clientcert option is allowed for
all auth methods, I worked on the assumption that the map option should
also be accepted for all methods, and removed the corresponding check:

--- postgresql-13-13.2.orig/src/backend/libpq/hba.c
+++ postgresql-13-13.2/src/backend/libpq/hba.c
@@ -1678,12 +1678,6 @@ parse_hba_auth_opt(char *name, char *val
  
        if (strcmp(name, "map") == 0)
        {
-               if (hbaline->auth_method != uaIdent &&
-                       hbaline->auth_method != uaPeer &&
-                       hbaline->auth_method != uaGSS &&
-                       hbaline->auth_method != uaSSPI &&
-                       hbaline->auth_method != uaCert)
-                       INVALID_AUTH_OPTION("map", gettext_noop("ident, peer, gssapi, sspi, and cert"));
                hbaline->usermap = pstrdup(val);
        }
        else if (strcmp(name, "clientcert") == 0)

With this change in place, the mapping works for me, with apparently no
ill effects. The build is passing all tests as well.

Should I report this as a bug?

Regards, Til